WordPress plugin

Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI security & vulnerabilities

Q: Does Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI have known vulnerabilities?

Yes. VulnCrest Radar lists 31 known vulnerabilities in Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI: 4 critical, 6 high, 21 medium. At least one is not fixed in the latest version.

Q: How do I check which version of Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

Q: What is the most recent Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI vulnerability?

CVE-2026-115483, published Nov 10, 2026: Everest Forms <= 3.6.3 - Unauthenticated Arbitrary File Read via 'Signature' Field Meta Key Branch of attach_entry_files. Severity: High (CVSS 7.5).

Q: Is any Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI vulnerability listed in CISA KEV?

No. None of the known Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI vulnerabilities is currently listed in the CISA KEV catalog.

everest-forms— active installsLast vulnerability Nov 10, 2026

Unpatched vulnerability in the latest version

At least one vulnerability affects the latest version and no fix has been released. Deactivate the plugin or restrict access to the affected feature until the vendor ships a patch.

Watch plugin

31Known vulnerabilities

Critical4
High6
Medium21
Low0

Vulnerabilities per year

All Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI vulnerabilities

Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI vulnerabilities
Severity	Vulnerability	CVE	Published
High7.5	Unauthenticated Arbitrary File Read via 'Signature' Field Meta Key Branch of attach_entry_files ≤3.6.3No patch available	CVE-2026-115483	Nov 10
High8.2	Unauthenticated Arbitrary File Deletion via 'everest_forms_{form_id}_old_{field_id}' Parameter ≤3.6.2Update to 3.6.3	CVE-2026-120513	Nov 09
High7.2	Unauthenticated Stored Cross-Site Scripting ≤3.6.1Update to 3.6.2	CVE-2026-108491	Oct 13
High8.1	Unauthenticated PHP Object Injection ≤3.6.0Update to 3.6.1	CVE-2026-62103	Sep 11
High8.1	Unauthenticated Arbitrary File Read and Deletion via Upload Field 'old_files' Parameter ≤3.4.4Update to 3.4.5	CVE-2026-5478	Apr 20
Critical9.8	Unauthenticated PHP Object Injection via Form Entry Metadata ≤3.4.3Update to 3.4.4	CVE-2026-3296	Apr 07
Critical9.8	Unauthenticated PHP Object Injection ≤3.1.1Update to 3.1.2	CVE-2025-3439	Apr 10, 2025
Critical9.8	Unauthenticated Arbitrary File Upload, Read, and Deletion ≤3.0.9.4Update to 3.0.9.5	CVE-2025-1128	Feb 17, 2025
High7.2	Unauthenticated Server-Side Request Forgery via font_url ≤2.0.7Update to 2.0.8	CVE-2024-1812	Mar 15, 2024
Critical9.8	SQL Injection <1.5.0Update to 1.5.0	CVE-2019-13575	Jul 18, 2019

High7.5
Unauthenticated Arbitrary File Read via 'Signature' Field Meta Key Branch of attach_entry_files
≤3.6.3No patch available
CVE-2026-115483Nov 10
High8.2
Unauthenticated Arbitrary File Deletion via 'everest_forms_{form_id}_old_{field_id}' Parameter
≤3.6.2Update to 3.6.3
CVE-2026-120513Nov 09
High7.2
Unauthenticated Stored Cross-Site Scripting
≤3.6.1Update to 3.6.2
CVE-2026-108491Oct 13
High8.1
Unauthenticated PHP Object Injection
≤3.6.0Update to 3.6.1
CVE-2026-62103Sep 11
High8.1
Unauthenticated Arbitrary File Read and Deletion via Upload Field 'old_files' Parameter
≤3.4.4Update to 3.4.5
CVE-2026-5478Apr 20
Critical9.8
Unauthenticated PHP Object Injection via Form Entry Metadata
≤3.4.3Update to 3.4.4
CVE-2026-3296Apr 07
Critical9.8
Unauthenticated PHP Object Injection
≤3.1.1Update to 3.1.2
CVE-2025-3439Apr 10, 2025
Critical9.8
Unauthenticated Arbitrary File Upload, Read, and Deletion
≤3.0.9.4Update to 3.0.9.5
CVE-2025-1128Feb 17, 2025
High7.2
Unauthenticated Server-Side Request Forgery via font_url
≤2.0.7Update to 2.0.8
CVE-2024-1812Mar 15, 2024
Critical9.8
SQL Injection
<1.5.0Update to 1.5.0
CVE-2019-13575Jul 18, 2019

Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI: common questions

Does Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI have known vulnerabilities?

Yes. VulnCrest Radar lists 31 known vulnerabilities in Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI: 4 critical, 6 high, 21 medium. At least one is not fixed in the latest version.

How do I check which version of Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

What is the most recent Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI vulnerability?

CVE-2026-115483, published Nov 10, 2026: Everest Forms <= 3.6.3 - Unauthenticated Arbitrary File Read via 'Signature' Field Meta Key Branch of attach_entry_files. Severity: High (CVSS 7.5).

Is any Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI vulnerability listed in CISA KEV?

No. None of the known Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI vulnerabilities is currently listed in the CISA KEV catalog.